What happened
On August 20, 2024, a phishing victim signed a transaction transferring control of a Maker vault to an attacker. BlockSec traced roughly 55 million DAI drained from the vault.
Technical root cause
Phishing induced an authorized change of vault ownership. The documented sequence establishes misuse of ownership permissions rather than a demonstrated Maker code vulnerability.
How it happened
- The victim signed a transaction changing the vault owner to a phishing address.
- About five hours later, the phisher assigned ownership to another address.
- Around 20 minutes afterward, that address drained roughly 55 million DAI.
- Funds moved through downstream addresses, DAI-to-ETH swaps, exchanges and bridges.
Protocol details
Classification
Other
Protocol Type
Exploit/Phishing
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
